CVE-2023-20092: Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite Vulnerability
First published: Fri Nov 15 2024(Updated: )
Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account. Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence Collaboration Endpoint Software | ||
| Cisco RoomOS |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-20092?
CVE-2023-20092 has been rated with a medium severity level.
How do I fix CVE-2023-20092?
To fix CVE-2023-20092, update the affected Cisco TelePresence Collaboration Endpoint or RoomOS Software to the latest version provided by Cisco.
Who is affected by CVE-2023-20092?
Cisco TelePresence Collaboration Endpoint and Cisco RoomOS Software users are affected by CVE-2023-20092.
What type of attack does CVE-2023-20092 allow?
CVE-2023-20092 allows an authenticated local attacker to overwrite arbitrary files on the local file system.
What are the exploited conditions for CVE-2023-20092?
CVE-2023-20092 exploits improper access controls on certain files within the Cisco TelePresence CE and RoomOS CLI.
- agent/references
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco telepresence collaboration endpoint software
- canonical/cisco roomos